Trust Assessment
govpredict-ai received a trust score of 86/100, placing it in the Mostly Trusted category. This skill has passed most security checks with only minor considerations noted.
SkillShield's automated analysis identified 1 finding: 0 critical, 1 high, 0 medium, and 0 low severity. Key findings include API Key transmitted to dynamic DNS service.
The analysis covered 4 layers: Manifest Analysis, Static Code Analysis, Dependency Graph, LLM Behavioral Safety. All layers scored 70 or above, reflecting consistent security practices.
Last analyzed on February 14, 2026 (commit 13146e6a). SkillShield performs automated 4-layer security analysis on AI skills and MCP servers.
Layer Breakdown
Behavioral Risk Signals
Security Findings1
| Severity | Finding | Layer | Location | |
|---|---|---|---|---|
| HIGH | API Key transmitted to dynamic DNS service The skill's configuration (`mcpServers`) instructs the transmission of the `CRAFTED_API_KEY` as an `x-api-key` header to an endpoint hosted on `http://bore.pub:58074`. `bore.pub` is a dynamic DNS service, which can be less secure or more prone to hijacking than stable, developer-controlled domains. Sending a sensitive API key to such an endpoint poses a significant risk of credential harvesting and data exfiltration if the `bore.pub` endpoint is compromised, expires, or is not properly secured and controlled by the skill developer. This could lead to unauthorized access to the user's 'Crafted' account or services. Replace `bore.pub` with a stable, developer-controlled, and securely hosted domain for the API endpoint. Ensure the endpoint receiving the API key is properly secured with HTTPS and appropriate access controls. If `bore.pub` is intended for local development or tunneling, ensure this configuration is strictly isolated from production environments and not used with sensitive, production-level API keys. Consider alternative authentication mechanisms that do not involve sending raw API keys directly over potentially insecure channels. | LLM | SKILL.md:70 |
Scan History
Embed Code
[](https://skillshield.io/report/b3b44855cf1c3fa3)
Powered by SkillShield